@camstack/system 1.2.438 → 1.2.440

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
+const require_custom_action_registry = require("./custom-action-registry-BKmoaqG0.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;

package/dist/addon-utils.mjs

@@ -1,3 +1,3 @@
-import { C as isModelDownloaded, S as isModelDownloadHttpError, _ as downloadFile, a as startEventLoopStallMonitor, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, p as ModelDownloadHttpError, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
+import { C as isModelDownloaded, S as isModelDownloadHttpError, _ as downloadFile, a as startEventLoopStallMonitor, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, p as ModelDownloadHttpError, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-CyUuhATc.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/{agent-https-BZIwS4xF.js → agent-https-DlpTMDqA.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
@@ -101,6 +101,188 @@ function getProcessAgentHttpsNames() {
 	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
 }
 //#endregion
+//#region src/tls/cert-name-constraints.ts
+/**
+* Name constraints of the hub's generated local CA (D873).
+*
+* An unconstrained private CA vouches for EVERY site on the internet to any
+* device that trusts it, so a leaked CA key would let its holder impersonate
+* a bank. The generated CA therefore carries a CRITICAL `nameConstraints`
+* extension (RFC 5280 4.2.1.10) that limits what it can ever certify to the
+* private address space and local-only names. A verifier that does not
+* understand a critical extension must reject the certificate, so the
+* constraint cannot be silently ignored by a conforming client.
+*
+* Pure: no filesystem, no clock. `cert-issue.ts` embeds the extension,
+* `cert-manager.ts` filters leaf names through {@link permitsIdentity}.
+*/
+/** `id-ce-nameConstraints`. */
+var NAME_CONSTRAINTS_OID = "2.5.29.30";
+/** The address space the generated CA may certify. 100.64.0.0/10 is CGNAT, which Tailscale hands out. Loopback is for the hub's own `127.0.0.1` / `::1` SANs. */
+var PERMITTED_IP_RANGES = [
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"fc00::/7",
+	"::1/128"
+];
+/**
+* Local-only DNS suffixes: none of them is delegated in public DNS. A leading
+* dot permits every name under the suffix and not the suffix itself.
+*/
+var PERMITTED_DNS_SUFFIXES = [
+	".local",
+	".lan",
+	".home.arpa",
+	".internal",
+	".localdomain",
+	"localhost"
+];
+var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
+/** A name that cannot collide with public DNS: a single label, or under a local-only suffix. */
+function isLocalOnlyHostname(name) {
+	const lower = name.toLowerCase();
+	if (lower.length === 0 || lower.length > 253) return false;
+	if (!lower.includes(".")) return LABEL_RE.test(lower);
+	if (!PERMITTED_DNS_SUFFIXES.some((suffix) => suffix.startsWith(".") && lower.endsWith(suffix))) return false;
+	return lower.split(".").every((label) => LABEL_RE.test(label));
+}
+/**
+* The constraint set for a new CA. `hostnames` are the hub's own local-only
+* names at creation time (a single-label OS hostname has no suffix to hide
+* under), added as exact entries; anything that could collide with public DNS
+* is dropped here, never constrained in.
+*/
+function buildNameConstraintSet(hostnames) {
+	const dns = new Set(PERMITTED_DNS_SUFFIXES);
+	for (const name of hostnames) {
+		const lower = name.trim().toLowerCase();
+		if ((0, node_net.isIP)(lower) === 0 && isLocalOnlyHostname(lower)) dns.add(lower);
+	}
+	return {
+		ipRanges: PERMITTED_IP_RANGES,
+		dnsNames: [...dns],
+		critical: true
+	};
+}
+/** The `nameConstraints` extension for a CA: permitted subtrees only, marked critical. */
+function createNameConstraintsExtension(set) {
+	const subtrees = [...set.ipRanges.map((range) => new require_x509_es.GeneralSubtree({ base: new require_x509_es.GeneralName({ iPAddress: range }) })), ...set.dnsNames.map((name) => new require_x509_es.GeneralSubtree({ base: new require_x509_es.GeneralName({ dNSName: name }) }))];
+	const value = require_x509_es.AsnConvert.serialize(new require_x509_es.NameConstraints({ permittedSubtrees: new require_x509_es.GeneralSubtrees(subtrees) }));
+	return new require_x509_es.Extension(NAME_CONSTRAINTS_OID, set.critical, value);
+}
+/** The CA's constraint set, or `null` when the certificate carries no `nameConstraints`. */
+function readNameConstraints(cert) {
+	const ext = cert.extensions.find((e) => e.type === NAME_CONSTRAINTS_OID);
+	if (ext === void 0) return null;
+	const parsed = require_x509_es.AsnConvert.parse(ext.value, require_x509_es.NameConstraints);
+	const ipRanges = [];
+	const dnsNames = [];
+	for (const subtree of parsed.permittedSubtrees ?? []) {
+		if (subtree.base.iPAddress !== void 0) ipRanges.push(subtree.base.iPAddress);
+		if (subtree.base.dNSName !== void 0) dnsNames.push(subtree.base.dNSName.toLowerCase());
+	}
+	return {
+		ipRanges,
+		dnsNames,
+		critical: ext.critical
+	};
+}
+/**
+* True when a CA is safe to keep as the hub's anchor: constrained to a
+* non-empty permitted set AND marked critical. A non-critical constraint is
+* ignored by clients that do not know the extension, which is the same as none.
+*/
+function isConstrainedCa(cert) {
+	const set = readNameConstraints(cert);
+	return set !== null && set.critical && (set.ipRanges.length > 0 || set.dnsNames.length > 0);
+}
+function ipv4ToBigInt(address) {
+	return address.split(".").reduce((acc, octet) => acc << 8n | BigInt(Number(octet)), 0n);
+}
+function ipv6ToBigInt(address) {
+	const mapped = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+	let text = address;
+	if (mapped !== null) {
+		const v4 = ipv4ToBigInt(mapped[2] ?? "0.0.0.0");
+		text = `${mapped[1] ?? ""}${(v4 >> 16n & 65535n).toString(16)}:${(v4 & 65535n).toString(16)}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = (halves[0] ?? "") === "" ? [] : (halves[0] ?? "").split(":");
+	const tail = halves.length === 2 && (halves[1] ?? "") !== "" ? (halves[1] ?? "").split(":") : [];
+	const fill = halves.length === 2 ? 8 - head.length - tail.length : 0;
+	if (fill < 0 || halves.length === 1 && head.length !== 8) return null;
+	return [
+		...head,
+		...Array(fill).fill("0"),
+		...tail
+	].reduce((acc, group) => acc << 16n | BigInt(Number.parseInt(group, 16)), 0n);
+}
+function toBigInt(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 4) return {
+		value: ipv4ToBigInt(address),
+		bits: 32
+	};
+	if (family === 6) {
+		const value = ipv6ToBigInt(address);
+		return value === null ? null : {
+			value,
+			bits: 128
+		};
+	}
+	return null;
+}
+function ipInRange(address, range) {
+	const [base, prefixText] = range.split("/");
+	if (base === void 0 || prefixText === void 0) return false;
+	const target = toBigInt(address);
+	const net = toBigInt(base);
+	const prefix = Number(prefixText);
+	if (target === null || net === null || target.bits !== net.bits) return false;
+	if (!Number.isInteger(prefix) || prefix < 0 || prefix > net.bits) return false;
+	const shift = BigInt(net.bits - prefix);
+	return target.value >> shift === net.value >> shift;
+}
+/** RFC 5280 DNS matching: a leading dot is a strict subtree, a bare name is itself and everything under it. */
+function dnsPermitted(name, constraint) {
+	const lower = name.toLowerCase();
+	if (constraint.startsWith(".")) return lower.endsWith(constraint);
+	return lower === constraint || lower.endsWith(`.${constraint}`);
+}
+/** Is this SAN value (an IP literal or a DNS name) inside the permitted set? */
+function permitsName(set, value) {
+	if ((0, node_net.isIP)(value) !== 0) return set.ipRanges.some((range) => ipInRange(value, range));
+	return set.dnsNames.some((constraint) => dnsPermitted(value, constraint));
+}
+/**
+* The part of an identity the CA is allowed to certify. A leaf naming
+* anything outside the constraints makes the WHOLE chain fail validation in
+* OpenSSL, so such names are dropped (and reported), never signed. The
+* required lists shrink the same way: otherwise a name the CA cannot certify
+* would count as a permanent SAN gap and reissue the leaf on every boot.
+*/
+function permitsIdentity(set, identity) {
+	const dropped = /* @__PURE__ */ new Set();
+	const keep = (values) => values.filter((value) => {
+		if (permitsName(set, value)) return true;
+		dropped.add(value);
+		return false;
+	});
+	return {
+		identity: {
+			dnsNames: keep(identity.dnsNames),
+			ipAddresses: keep(identity.ipAddresses),
+			requiredDnsNames: keep(identity.requiredDnsNames),
+			requiredIpAddresses: keep(identity.requiredIpAddresses)
+		},
+		dropped: [...dropped]
+	};
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -129,7 +311,8 @@ var REASONS_REQUIRING_NEW_CA = [
 	"missing",
 	"unreadable",
 	"no-local-ca",
-	"ca-expiring"
+	"ca-expiring",
+	"ca-unconstrained"
 ];
 function reasonRequiresNewCa(reason) {
 	return REASONS_REQUIRING_NEW_CA.includes(reason);
@@ -141,6 +324,14 @@ function parse(pem) {
 		return null;
 	}
 }
+/** A root without a CRITICAL name constraint (every pre-D873 install) can vouch for any site. */
+function caIsUnconstrained(caPem) {
+	try {
+		return !isConstrainedCa(new require_x509_es.X509Certificate(caPem));
+	} catch {
+		return true;
+	}
+}
 function daysBetween(from, to) {
 	return (to.getTime() - from.getTime()) / MS_PER_DAY$1;
 }
@@ -171,6 +362,7 @@ function evaluateExistingCert(input) {
 	const ca = parse(input.caPem);
 	if (leaf === null || ca === null) return "unreadable";
 	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (caIsUnconstrained(input.caPem)) return "ca-unconstrained";
 	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
 	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
 	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
@@ -383,13 +575,18 @@ function subjectAltNames(identity) {
 * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
 * else, and **no EKU** — Apple rejects an anchor asserting
 * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*
+* It carries a CRITICAL `nameConstraints` extension (D873): private address
+* ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
+* names at creation). A leaked key therefore cannot vouch for a public site.
 */
-async function generateCa(now) {
+async function generateCa(now, hostnames = []) {
 	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(true, 0, true),
 		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey),
+		createNameConstraintsExtension(buildNameConstraintSet(hostnames))
 	];
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
@@ -652,14 +849,6 @@ function describeHttpsLeaf(certPem) {
 		notAfter: Date.parse(x509.validTo)
 	};
 }
-var LOCAL_SUFFIXES = [
-	".local",
-	".lan",
-	".home.arpa",
-	".internal",
-	".localdomain"
-];
-var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
 /** Private-network IPv4/IPv6: RFC 1918, CGNAT (Tailscale), link-local, ULA. */
 function isPrivateAddress(address) {
 	const family = (0, node_net.isIP)(address);
@@ -677,14 +866,6 @@ function isPrivateAddress(address) {
 function isContainerBridgeAddress(address) {
 	return /^172\.17\.\d{1,3}\.\d{1,3}$/.test(address);
 }
-/** A name that cannot collide with public DNS. */
-function isLocalOnlyHostname(name) {
-	const lower = name.toLowerCase();
-	if (lower.length === 0 || lower.length > 253) return false;
-	if (!lower.includes(".")) return LABEL_RE.test(lower);
-	if (!LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return false;
-	return lower.split(".").every((label) => LABEL_RE.test(label));
-}
 /**
 * The names the hub will sign for `nodeId`: its node id and the address of its live mesh
 * socket - nothing the agent says about itself. `excluded` holds every name already taken
@@ -737,14 +918,21 @@ async function issueAgentHttpsLeaf(input) {
 	if (!(0, node_fs.existsSync)(caCertPath) || !(0, node_fs.existsSync)(caKeyPath)) throw new Error("the hub has no local CA to sign with (no tls/camstack-ca.crt + key)");
 	const excluded = new Set(input.takenByOthers ?? []);
 	if ((0, node_fs.existsSync)(hubLeafPath)) for (const name of certificateNames((0, node_fs.readFileSync)(hubLeafPath, "utf8"))) excluded.add(name);
-	const sans = acceptAgentSans({
+	const ca = await loadCa((0, node_fs.readFileSync)(caCertPath, "utf8"), (0, node_fs.readFileSync)(caKeyPath, "utf8"));
+	const policy = acceptAgentSans({
 		nodeId: input.nodeId,
 		observedAddress: input.observedAddress,
 		excluded,
 		...input.reportedNames !== void 0 ? { reported: input.reportedNames } : {}
 	});
+	const constraints = readNameConstraints(ca.cert);
+	const constrained = constraints === null ? null : permitsIdentity(constraints, policy.identity);
+	const sans = constrained === null ? policy : {
+		identity: constrained.identity,
+		accepted: policy.accepted.filter((name) => !constrained.dropped.includes(name)),
+		rejected: [...policy.rejected, ...constrained.dropped.map((name) => `${name} (outside the local CA's name constraints)`)]
+	};
 	if (sans.accepted.length === 0) throw new Error(`no name of node '${input.nodeId}' can be certified (${sans.rejected.join("; ") || "nothing offered"})`);
-	const ca = await loadCa((0, node_fs.readFileSync)(caCertPath, "utf8"), (0, node_fs.readFileSync)(caKeyPath, "utf8"));
 	return {
 		certPem: await issueLeafFromCsr(ca, input.csrPem, sans.identity, input.nodeId, 397, input.now ?? /* @__PURE__ */ new Date()),
 		caCertPem: ca.certPem,
@@ -805,6 +993,18 @@ Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
 		return MAX_LEAF_VALIDITY_DAYS;
 	}
 });
+Object.defineProperty(exports, "PERMITTED_DNS_SUFFIXES", {
+	enumerable: true,
+	get: function() {
+		return PERMITTED_DNS_SUFFIXES;
+	}
+});
+Object.defineProperty(exports, "PERMITTED_IP_RANGES", {
+	enumerable: true,
+	get: function() {
+		return PERMITTED_IP_RANGES;
+	}
+});
 Object.defineProperty(exports, "SERVER_AUTH_OID", {
 	enumerable: true,
 	get: function() {
@@ -823,6 +1023,12 @@ Object.defineProperty(exports, "agentHttpsPaths", {
 		return agentHttpsPaths;
 	}
 });
+Object.defineProperty(exports, "buildNameConstraintSet", {
+	enumerable: true,
+	get: function() {
+		return buildNameConstraintSet;
+	}
+});
 Object.defineProperty(exports, "certificateNames", {
 	enumerable: true,
 	get: function() {
@@ -877,6 +1083,12 @@ Object.defineProperty(exports, "installAgentHttps", {
 		return installAgentHttps;
 	}
 });
+Object.defineProperty(exports, "isConstrainedCa", {
+	enumerable: true,
+	get: function() {
+		return isConstrainedCa;
+	}
+});
 Object.defineProperty(exports, "isContainerBridgeAddress", {
 	enumerable: true,
 	get: function() {
@@ -925,12 +1137,30 @@ Object.defineProperty(exports, "pemDigest", {
 		return pemDigest;
 	}
 });
+Object.defineProperty(exports, "permitsIdentity", {
+	enumerable: true,
+	get: function() {
+		return permitsIdentity;
+	}
+});
+Object.defineProperty(exports, "permitsName", {
+	enumerable: true,
+	get: function() {
+		return permitsName;
+	}
+});
 Object.defineProperty(exports, "pinnedHttpsCaFingerprint", {
 	enumerable: true,
 	get: function() {
 		return pinnedHttpsCaFingerprint;
 	}
 });
+Object.defineProperty(exports, "readNameConstraints", {
+	enumerable: true,
+	get: function() {
+		return readNameConstraints;
+	}
+});
 Object.defineProperty(exports, "reasonRequiresNewCa", {
 	enumerable: true,
 	get: function() {